retro-session
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests Claude Code session transcripts which contain logs of previous interactions, potentially including untrusted data from external tool outputs or web content. This creates an indirect prompt injection surface where malicious instructions in past logs could influence the current session.
- Ingestion points: The skill reads .jsonl transcript files from the ~/.claude/projects/ directory.
- Boundary markers: The SKILL.md explicitly instructs the agent that everything read from transcripts is data, not instructions, and provides a clear warning not to follow commands found within them.
- Capability inventory: The skill executes a local analysis script (scripts/scan.js) and has the ability to write records and propose environment fixes (e.g., git branches, pull requests).
- Sanitization: The provided scripts/scan.js includes a redact function that masks sensitive credentials such as GitHub tokens, API keys, and passwords before processing the transcript content.
- [COMMAND_EXECUTION]: The skill invokes a local JavaScript utility (node scripts/scan.js) to perform automated analysis of session history. This execution is limited to scripts provided within the skill's own package.
Audit Metadata